The render thread freed the overlays as soon as it exited, while the
main thread could still be dispatching display server input callbacks
that iterate them. Free the overlays in lg_shutdown instead, once the
render thread has been joined and the display server has shut down.
The overlays now outlive the renderer, so overlayFreeImage must not
call into it; renderer deinitialization has already destroyed all
textures along with the context.
evdev_stop was never called, and calling it revealed unsafe teardown:
the device list was freed before the thread was joined, a zero epoll
descriptor was mistaken for a valid one, and the device loops walked
past the end of the array through a sentinel that does not exist.
Join the thread in evdev_stop and defer the rest to the new evdev_free.
The display server grab hooks route into evdev until its event thread
is joined, so the device state must stay valid until the display
server has been freed; evdev_free then restores the hooks and releases
the state.
setWindowSize is called from the render, frame and transport threads,
but shellResize issues shell requests and, with the libdecor GTK
plugin, renders the window decorations through pango, none of which is
thread safe. A frame thread exiting after such a call crashed in the
pango fontmap destructor during thread teardown.
Publish the requested size atomically and wake the event loop through
an eventfd registered in the epoll; the poll callback applies the size
on the event-loop thread. Concurrent requests coalesce into the most
recent one.
Report expected and current protocol versions through the transport
interface and expose session-independent recovery operations.
Offer recovery from the version mismatch popup, publish requests through
the reserved IVSHMEM channel, and select the validated SPICE fallback.
Add a protocol-independent recovery channel outside LGMP so clients can
request a usable guest display even when transport versions differ.
Synchronize recovery state with the helper across driver restarts and
restore the configured topology without persisting temporary changes.
Define a fixed, protocol-independent recovery ABI in the final 64 KiB
of IVSHMEM.
Provide crash-safe multi-client requests and coherent producer status.
Exclude the region from LGMP allocation and frame capacity so future
protocol mismatches retain a stable control path.
Make CSRWLock own the native lock and provide scoped guards for shared,
exclusive, early-unlock, and non-blocking use.
Replace direct SRW lock management throughout the IDD, input driver,
and helper while preserving the existing lock scopes.
Register SPICE connection and component options in the SPICE transport.
Move generic input and clipboard settings out of the SPICE namespace,
while retaining migration aliases for existing configurations.
Keep PureSpice and usbredir build requirements private to the transport,
and remove obsolete SPICE configuration state from the client core.
Track primary and fallback video with source-specific generations, and
publish a source only after its first frame or software surface is
ready.
Route SPICE surfaces and cursors through the generic render queue. Keep
the current image across handoffs, and switch input only after the new
source has been presented.
Move fallback activation to its worker so display callbacks cannot
block or deadlock the render path.
Treat autoCapture as keyboard ownership while the pointer is inside the
guest viewport. Predict the next local position for both absolute and
relative motion, then release the keyboard before the pointer crosses
an edge.
Keep capture, focus, and deferred evdev transitions consistent while
retaining the latest local position as the prediction baseline.
X11's legacy guest-position synchronization warps the host cursor to
delayed guest updates. With absolute input this feeds old positions back
through cooked motion and pulls the cursor away from window edges.
Skip display-server guest synchronization when the active input is
absolute. Relative input and explicit uncapture alignment are unchanged.
Normal input now uses absolute positioning, so retaining the XI pointer
grab after capture leaves no later path to release it.
Always release the grab so leaving the window works again and the
uncapture path can align the host cursor to the guest position.
Replay held keys after focus enters the client window.
Track modifiers and lock LEDs for cooked and grabbed raw input.
Handle external XKB indicator changes while the window stays focused.
Make cooked mouse input independent of keyboard focus.
Preserve button state across pointer leave events.
Match Wayland event order, wheel steps, and raw motion delivery.
Update PureSpice so microphone delivery cannot hold audio backend
shutdown behind a busy socket. Record packets now use a bounded
nonblocking write with framing-safe failure handling.
Rework audio provider and backend lifecycles so playback and capture
callbacks quiesce without blocking real-time threads. Move activation,
teardown, controls, retries, and diagnostics onto bounded workers.
Harden USB audio cadence, feedback, and capture recovery.
Preserve source clocks through recording and pace packets from the
device clock. Bound queues, waits, conversion buffers, and packet sizes.
Make PipeWire and PulseAudio stream control thread-safe and recoverable.
Correct latency clock domains, coalesce rate updates, preserve recent
capture under overload, and keep logging outside real-time callbacks.
